Repository navigation
chore: updated deps #82
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - development | |
| permissions: | |
| contents: read | |
| jobs: | |
| dco: | |
| name: DCO sign-off | |
| # Only pull requests. History predating brain decision 0008 is unsigned and | |
| # is deliberately not rewritten, so checking pushes would fail on ancestors. | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Every commit carries a matching Signed-off-by | |
| shell: bash | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| missing=0 | |
| checked=0 | |
| # Merge commits are exempt: they carry no authored change. | |
| while read -r sha; do | |
| [[ -n "${sha}" ]] || continue | |
| checked=$((checked + 1)) | |
| author="$(git log -1 --format='%aN <%aE>' "${sha}")" | |
| if ! git log -1 --format='%(trailers:key=Signed-off-by,valueonly)' "${sha}" \ | |
| | grep -qiFx "${author}"; then | |
| echo "::error::${sha:0:8} $(git log -1 --format=%s "${sha}")" | |
| echo " no Signed-off-by matching the author: ${author}" | |
| missing=$((missing + 1)) | |
| fi | |
| done < <(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}") | |
| if (( missing > 0 )); then | |
| echo | |
| echo "${missing} of ${checked} commit(s) lack a matching sign-off." | |
| echo "Fix with: git rebase --signoff ${BASE_SHA}" | |
| echo "Then: git push --force-with-lease" | |
| echo "See DCO.txt and CONTRIBUTING.md." | |
| exit 1 | |
| fi | |
| echo "OK: all ${checked} commit(s) signed off." | |
| license-headers: | |
| name: SPDX license headers | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Every in-scope file carries an SPDX header | |
| run: .github/scripts/spdx-headers.sh check | |
| shellcheck: | |
| name: shellcheck | |
| runs-on: ubuntu-latest | |
| # Gating since 2026-08-28: every script is clean at --severity=warning in | |
| # all four repositories. A new warning is a change to fix, not to absorb. | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Run shellcheck | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| command -v shellcheck >/dev/null || sudo apt-get install -y shellcheck | |
| mapfile -t files < <(git ls-files '*.sh') | |
| if (( ${#files[@]} == 0 )); then | |
| echo "No shell scripts." | |
| exit 0 | |
| fi | |
| shellcheck --severity=warning --external-sources "${files[@]}" | |
| tests: | |
| name: Bash test suite | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Run every *.test.sh | |
| shell: bash | |
| run: | | |
| set -uo pipefail | |
| # git ls-files, not find: it skips node_modules, build output and | |
| # anything else untracked, and it fails loudly on a broken checkout. | |
| mapfile -t files < <(git ls-files '*.test.sh') | |
| if (( ${#files[@]} == 0 )); then | |
| echo "No test scripts in this repository." | |
| exit 0 | |
| fi | |
| status=0 | |
| for file in "${files[@]}"; do | |
| echo "::group::${file}" | |
| if ! bash "${file}"; then | |
| status=1 | |
| echo "::error file=${file}::${file} failed" | |
| fi | |
| echo "::endgroup::" | |
| done | |
| exit "${status}" |